We use cookies to make your experience of our websites better. By using and further navigating this website you accept this. Detailed information about the use of cookies on this website is available by clicking on more information.

How to protect your computer from Trojan-Ransom.Win32.Xorist ransomware

The XoristDecryptor tool is designed for fighting malware of the Trojan-Ransom.Win32.Xorist and Trojan-Ransom.MSIL.Vandev family.

Malware of the family Trojan-Ransom.Win32.Xorist gains unauthorized access to the victim computer and modifiesdata on it. This makes the files or the whole system unaccessible. After blocking the files, malware demands ransom.

The victim is supposed to deliver the ransom to criminals and receive a tool which decrypts the data or restores normal functioning of the computer.

Signs of infection

The user is displayed with messages demanding to send an SMS to decrypt the files.

Another sign is presence of a file named “Read Me: how to decrypt files” on disk C.

What to do if the tool did not help

If the XoristDecryptor tool detects an unknown malicious file, it suggests sending the file to stopgpcode@kaspersky.com. Kaspersky Lab specialists analyze the file and update databases of XoristDecryptor. At the next launch of the tool, the tool will download new databases and disinfect the files.

By sending a malicious file to Kaspersky Lab specialists, you help protecting other users from ransomware.

Safety 101: Questions and answers

Safety 101: Protection tips

Safety 101: Virus-fighting tools

How to protect your computer from Trojan-Ransom.Win32.Xorist ransomware

The XoristDecryptor tool is designed for fighting malware of the Trojan-Ransom.Win32.Xorist and Trojan-Ransom.MSIL.Vandev family.

Malware of the family Trojan-Ransom.Win32.Xorist gains unauthorized access to the victim computer and modifiesdata on it. This makes the files or the whole system unaccessible. After blocking the files, malware demands ransom.

The victim is supposed to deliver the ransom to criminals and receive a tool which decrypts the data or restores normal functioning of the computer.

Signs of infection

The user is displayed with messages demanding to send an SMS to decrypt the files.

Another sign is presence of a file named “Read Me: how to decrypt files” on disk C.

What to do if the tool did not help

If the XoristDecryptor tool detects an unknown malicious file, it suggests sending the file to stopgpcode@kaspersky.com. Kaspersky Lab specialists analyze the file and update databases of XoristDecryptor. At the next launch of the tool, the tool will download new databases and disinfect the files.

By sending a malicious file to Kaspersky Lab specialists, you help protecting other users from ransomware.